IAM Identity Center

An AWS account has at most one IAM Identity Center. The Hub finds it, or creates one when there is none, and lets you manage its users and groups. It never deletes IAM Identity Center, its users or its groups.

The Hub uses IAM Identity Center for two things: signing people in to the Hub itself (with IdentityProvider set to IAMIdentityCenter), and signing people in to the products you install with sign-in through the Hub.

#What the stack does

The IdentityCenterSetup parameter decides what happens when you create or update the Hub's stack:

The stack looks in every enabled Region at once, so it finds IAM Identity Center wherever it is. Regions that refuse the lookup, such as opt-in Regions you have not enabled or Regions an SCP blocks, are skipped and reported.

When the account owns the instance it found or created, the stack also makes sure there is a group named CloudCertaintyHubAdmins with a user for BootstrapAdminEmail in it.

The outputs say what happened:

When the stack is deleted, the setup does nothing: IAM Identity Center, its users and its groups stay.

#A standalone account

In an account that is not in an AWS Organization, CreateIfMissing creates an account instance when there is none: a user directory and an AWS access portal for this account only. The stack names it CloudCertainty. It then creates the CloudCertaintyHubAdmins group with your user in it.

The user the stack creates has no password. Before you sign in for the first time, open the IAM Identity Center console, choose Users, your user, and Reset password.

#The management account of an organisation

AWS does not allow an account instance in the management account of an AWS Organization. There, IAM Identity Center is the organisation instance, and it can only be enabled from the console.

The simplest order is to enable IAM Identity Center in the console first (open IAM Identity Center in the management account and choose Enable), then install the Hub. The stack finds the organisation instance, which this account owns, and creates the CloudCertaintyHubAdmins group and your user as in a standalone account.

If you install the Hub first, CreateIfMissing installs it anyway: the instance outputs are empty and IdentityCenterStatus gives the reason. The Hub's Identity Center page then shows the organisation, says this account is its management account, and offers Open IAM Identity Center. Enable it in the console, then choose Refresh in the Hub: it finds the new instance in any Region. In this order the stack has not created the CloudCertaintyHubAdmins group, so make people Hub administrators in the Hub's Settings, by email or by group.

With IdentityProvider set to IAMIdentityCenter, the Hub's SAML application is set up as in getting started: it needs only the stack outputs and the Region you enabled IAM Identity Center in.

#Member accounts of an organisation

When IAM Identity Center is enabled for your organisation, member accounts see the organisation instance, and the Hub finds it too. It belongs to the management account, so:

• Users, groups, the access portal and SAML applications are configured in the management account. The Hub's Identity Center page shows the organisation and its management account, and says so; ask its administrator for what you need.
• The Hub does not create or change users and groups in an organisation instance.
• The stack creates no CloudCertaintyHubAdmins group, and IdentityCenterAdminGroupId is empty. Make people Hub administrators in the Hub's Settings instead.
• The Hub's own SAML application is created in the management account.

If your organisation has no IAM Identity Center, CreateIfMissing creates an account instance in the member account, unless the organisation forbids member accounts to create one. AWS then refuses, the stack still installs, and IdentityCenterStatus gives AWS's reason.

#The CloudCertaintyHubAdmins group

Members of CloudCertaintyHubAdmins are Hub administrators. Add people to it on the Hub's Identity Center page, or in the IAM Identity Center console. To let them sign in to the Hub, assign the group to the Hub's SAML application.

Hub administrators are, together:

• the BootstrapAdminEmail, who always stays one;
• the emails listed in the Hub's Settings;
• members of the groups listed in Settings;
• members of CloudCertaintyHubAdmins.

#Users and groups in the Hub

The Hub's Identity Center page shows the instance, the Regions it checked, and the organisation the account belongs to. When the account owns the instance, you can also:

• Create IAM Identity Center when there is none: an account instance in the Region you choose, with an optional name.
• Choose an instance when the Hub finds several.
• Add users with an email address, a given name and a family name. The email is also the user name. New users have no password: send one from the IAM Identity Center console (Users, the user, Reset password).
• Add groups, and add or remove members.

The Hub never deletes users or groups. Lists show up to 1,000 users or groups.

#Signing in to the Hub through IAM Identity Center

The Hub's sign-in needs one SAML application in IAM Identity Center, which AWS only lets you create in the console. Getting started walks through it with the stack outputs. Once you are signed in, the Hub sign-in section of the Identity Center page shows the same values, the AWS CLI command that sets the metadata URL on the Hub's stack, and the Terraform input for it.

To move a Hub that uses another sign-in method to IAM Identity Center, update its stack with IdentityProvider set to IAMIdentityCenter, then follow the same steps.